VU#312260: Use-after-free vulnerability in lighttpd version 1.4.50 and earlier

CERT Security Advisory

Overview
A use-after-free vulnerability in lighttpd in versions 1.4.50 and earlier permits a remote, unauthenticated attacker to read from invalid pointers in CPU memory. The attacker can use crafted HTTP Requests to crash the web server and/or leak memory in order to access sensitive data. This vulnerability was fixed in 2018 by the lighttpd project. However, a number of implementations of lighttpd remain vulnerable due to a failure to apply the security updates provided by lighttpd.
Description
lighttpd is a lightweight web server software that is meant for low resource environments with limited CPU and memory. This open-source software is available in binary form and source code that is included in various IoT and firmware environments. In November of 2018, VDOO researchers disclosed a vulnerability related to the HTTP header parsing code in lighttpd versions 1.4.50 and earlier. This security issue was fixed by lighttpd as part of their 1.4.51 release in August 2018. At the time of disclosure, VDOO researchers identified the primary impact to be Denial of Service (DoS) using the unreleased memory pointer.
However, a CVE ID was not obtained as part of the fix outlined above, leaving the vulnerability without a public identifier. In April of 2024, Binarly discovered that the lighttpd vulnerability was still present in a number of products, presenting a supply-chain risk. The lack of CVE ID rendered the security fix invisible to projects that utilize earlier versions of lighttpd. Many organizations depend on a public CVE ID record to initiate security fixes and apply software updates. Binarly also documented many implementations of lighttpd (versions 1.4.50 and earlier) that allowed for a different set of attacks that can leak memory and access sensitive data. The supply-chain impact of this vulnerable software includes multiple products as highlighted in the blog by runZero. The lighttpd project has now obtained CVE-2018-25103 to identify this vulnerability and to alert supply-chain partners to implement the required fix.
Impact
The impact of this vulnerability varies largely due to the various ways lighttpd can be used a web server in various product implementations. In general, a remote unauthenticated attacker can use crafted HTTP Requests to crash the web server and/or leak memory in order to access sensitive data, such as process memory addresses.
Solution
The CERT/CC recommends applying the latest vendor-provided patch to address this issue. Review the Vendor Information below or contact your vendor or supplier for specific mitigation advice. If your device’s implementation of lighttpd is deemed end-of-life or end-of-support, replace your hardware or software as appropriate to avoid exposure to this vulnerability. Operators can also limit network access to lighttpd implementations to avoid exposure of this software to the public Internet and untrusted sources.
Acknowledgements
Thanks to Binarly for highlighting this vulnerability in supply-chain implementations. Thanks to Ori Hollander, VDOO for identifying and reporting the vulnerability in 2018. Thanks also to lighttpd project and vendor AMI that cooperated in supporting this public disclosure and outreach.This document was written by Vijay Sarvepalli.

Vendor Information

One or more vendors are listed for this advisory. Please reference the full report for more information.

References

https://www.runzero.com/blog/lighttpd/

https://github.com/lighttpd/lighttpd1.4/commit/df8e4f95614e476276a55e34da2aa8b00b1148e9

https://www.binarly.io/blog/lighttpd-gains-new-life

https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/AMI-SA-2024002.pdf

Giving Back – Securing Open Source IoT Projects

Other Information

CVE IDs:

CVE-2018-25103

Date Public:

2024-07-09

Date First Published:
2024-07-09

Date Last Updated:
2024-07-09 14:48 UTC

Document Revision:
1

About vulnerability notes
Contact us about this vulnerability
Provide a vendor statement

READ MORE

Leave a Reply

Your email address will not be published. Required fields are marked *